Phase 1: Solving workflow
1.1 Reconnaissance
file * # 识别文件类型
strings binary | grep -i flag # 快速字符串搜索
xxd binary | head -20 # Hex 头部
binwalk -e firmware.bin # 提取嵌入文件
checksec --file=binary # 检查保护
nc host port # 连接远程服务
1.2 Classification and Skill dispatch
By file type:
| File type | Category | Dispatch Skill |
|---|---|---|
| .pcap/.evtx/.raw/.dd | Forensics | ctf-forensics |
| ELF/PE + remote service | Pwn | ctf-pwn |
| ELF/PE/APK/.pyc/WASM | Reverse | ctf-reverse |
| .py/.sage + numbers | Cryptography | ctf-crypto |
| Web URL/HTML/JS/PHP | Web | ctf-web-methodology |
| Image/audio/PDF (no obvious content) | Steganography forensics | ctf-forensics |
By keyword:
| Keyword | Category |
|---|---|
| overflow/ROP/shellcode/heap | ctf-pwn |
| RSA/AES/cipher/lattice/LWE | ctf-crypto |
| XSS/SQLi/JWT/SSRF | ctf-web-methodology |
| disk image/memory dump/registry | ctf-forensics |
| find/locate/identify/who/where | ctf-osint |
| obfuscated/C2/malware/beacon | ctf-malware |
| jail/sandbox/encoding/game | ctf-misc |
1.3 Pivoting when stuck
- Reclassify — many challenges span categories (Web+Crypto, Forensics+Crypto, Reverse+Pwn)
- Check for omissions — hidden files, alternate ports, response headers, comments, metadata
- Simplify — check whether there is a simpler path (default credentials, known CVE, logic flaw)
Common cross-category patterns:
- Forensics + Cryptography: encrypted data in PCAP/disk
- Web + Reverse: WASM or obfuscated JS
- Web + Cryptography: JWT forgery, custom signatures
- Reverse + Pwn: reverse first, then exploit
- OSINT + Steganography: social media Unicode homoglyphs
Phase 2: Auxiliary information
2.1 Flag format
Common:flag{...} / CTF{...} / custom prefix (ENO{...} / HTB{...}）
grep -rniE '(flag|ctf|eno|htb|pico)\{' .
strings output.bin | grep -iE '\{.*\}'
2.2 Strategy when stuck
- Fallback reconnaissance: robots.txt, .git, backup files, directory scanning
2.3 File type identification
- SQLite database file: open with the sqlite3 command, use .tables to query the table structure